Information on Personal Data Processing

Information on the processing of personal data and access to personal data at the Heyrovský Institute of the CAS

The Heyrovský Institute of the CAS, Registration Number: 61388955, with its registered office at Dolejškova 2155/3, 182 23 Prague 8 – Libeň (hereinafter referred to as “HI”), hereby informs you, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the “Regulation GDPR”), about how and under what conditions personal data is processed at HI.

HI acts as the data controller when processing personal data and processes personal data only to the extent necessary for the purposes specified in this document. The categories of personal data processed are described in more detail in Sections II and III. If you have any questions regarding the processing of personal data, you can contact HI at: directoratheu.cas.cz.

I. Why we collect data

We process personal data where necessary to comply with our legal obligations, perform contracts, carry out tasks in the public interest and pursue legitimate interests, in particular for the following purposes:

  • ensuring internal processes,
  • carrying out tasks in the public interest,
  • administering contractual obligations,
  • sending newsletters and updating the website,
  • administering control processes,
  • organising conferences and workshops.

In the case of employees, we process personal data primarily for the purposes of managing payroll and HR administration, health and safety and fire safety, organising training and conferences, maintaining records of research staff qualifications, administering public funding, and transferring or publishing data in accordance with the Act on Support for Research, Experimental Development and Innovation from Public Funds and other applicable legislation. Personal data is always processed only to the extent necessary for the relevant purpose. In exceptional cases, we collect and process your personal data on the basis of your consent; in such cases, you will be informed, prior to giving your consent, of the purpose of such processing and the specific scope of the personal data we will process for that purpose.

II. What data do we collect

1. Employees:

For the purposes set out above, we collect and process, in particular, the following categories of personal data:

  • identification and contact details – in particular, first name, surname, title, contact address, contact telephone number, email address, employee identification number,
  • data relating to employment and professional activities – job position, educational qualifications, professional qualifications and other data relating to the performance of work,
  • payroll and payment details – in particular, bank account details and other data necessary for payroll processing and related payments,
  • data necessary for compliance with the employer’s obligations – in particular, data relating to fitness for work and other data whose processing is required by applicable legislation,
  • data relating to other persons – in particular, data concerning family members where necessary for compliance with the employer’s legal obligations or for the exercise of the employee’s rights,
  • other data – e.g. photographs.

Where necessary for a specific purpose of processing, HI may also obtain personal data from publicly available registers, lists or records, or from third parties, always in accordance with applicable legislation.

2. Contracting parties:

HI processes identification, contact and other personal data of contracting parties, their representatives and contact persons where necessary for the conclusion and performance of contracts, related administration, compliance with HI’s legal obligations and, where applicable, the protection of its legitimate interests.

3. Participants in conferences organised by the Heyrovský Institute

The HI collects and processes the personal data of participants in conferences which it (co-)organises. This includes, in particular, personal data provided by participants through the online registration form:

  • for registration in conference registration system,
  • for registration for a specific event, or
  • to submit an abstract or other document for a specific event, as well as data provided to HI by other means, in particular by email or telephone.

This personal data includes the participant’s title, first name and surname, their affiliation, email address and telephone number, information about the submitted abstract, and information on the payment of the registration fee.

We collect and process the personal data of conference participants for the purpose of organising and facilitating their participation in a specific event (e.g. a conference or workshop), communicating with participants and preparing the event programme. This includes registration and access to the event, sending information regarding the organisation and programme of the event, issuing and sending documents relating to your participation in the event (e.g. an invoice, a certificate of attendance), printing name badges and – in the event of your active participation in the event programme – inclusion in the event programme, book of abstracts, conference proceedings and similar documents.

HI does not process payment card details used to pay registration or other fees. Payments are made through secure online payment systems outside HI’s conference registration system. HI records only the information necessary to verify that the payment has been made.

III. How we process data

Personal data is processed both manually and via electronic information systems, which are subject to physical, technical and procedural controls. HI implements appropriate technical, organisational and personnel measures to protect personal data. Personal data may, to the extent necessary, be disclosed to recipients to whom HI is required to provide such data by law or in connection with the performance of its tasks, such as health insurance companies, the Czech Social Security Administration, grant providers or supervisory authorities.

HI may also engage data processors to process personal data on its behalf, in particular providers of IT services and technical support, information systems, networks and website operation, data storage, postal services, employee benefits, marketing services or payroll accounting. These processors process personal data only to the extent necessary to provide the relevant services and on the basis of a contractual relationship with HI.

HI does not carry out automated individual decision-making, including profiling, within the meaning of Article 22 of the GDPR.

IV. How long we retain the data

Personal data is retained only for as long as necessary for the purpose for which it is processed and subsequently for the period required by applicable legislation, HI’s Records Management and Disposal Policy or other internal regulations. The retention period varies depending on the purpose of processing and the type of personal data. Where personal data is processed on the basis of consent, the retention period or the method used to determine it is specified in the relevant consent.

V. What are your rights

Data subjects whose personal data is processed by HI have the rights provided for under the Regulation GDPR. Depending on the specific circumstances and the legal basis for the processing, these include in particular the right to:

  • access their personal data and obtain information about its processing;
  • have inaccurate personal data rectified or incomplete personal data completed;
  • have their personal data erased;
  • restrict the processing of their personal data;
  • data portability;
  • object to the processing of their personal data.

If you believe that the processing of your personal data infringes the Regulation GDPR, you also have the right to lodge a complaint with the supervisory authority, which in the Czech Republic is the Office for Personal Data Protection.

You can exercise your rights by contacting HI at: directoratheu.cas.cz.

VI. Right to withdraw consent

Where a data subject’s personal data is processed by HI on the basis of their consent for a specific purpose, the data subject may withdraw their consent at any time by sending an email to: directoratheu.cas.cz, or by sending a notice of withdrawal to HI at: Dolejškova 2155/3, 182 00 Prague 8 – Libeň, Czech Republic.

The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.